Parse out permissions

Author: Cyb3r-Jak3

.github/testing/main.tf

@@ -72,4 +72,4 @@ module "r2-api-token_eu" {
   bucket_write = false
   expires_on = timeadd(timestamp(), "10m")
   jurisdiction = "eu"
-}
+}

README.md

@@ -35,7 +35,7 @@ No modules.
 | Name | Type |
 |------|------|
 | [cloudflare_api_token.token](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token) | resource |
-| [cloudflare_account_api_token_permission_groups.this](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/data-sources/account_api_token_permission_groups) | data source |
+| [cloudflare_api_token_permission_groups_list.this](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/data-sources/api_token_permission_groups_list) | data source |
 
 ## Inputs
 
@@ -56,8 +56,5 @@ No modules.
 
 | Name | Description |
 |------|-------------|
-| <a name="output_id"></a> [id](#output\_id) | API Token ID.<br/>Used as the Access Key ID |
-| <a name="output_name"></a> [name](#output\_name) | Name of the API Token |
-| <a name="output_secret"></a> [secret](#output\_secret) | Secret Access Key |
-| <a name="output_value"></a> [value](#output\_value) | API Token Value |
+| <a name="output_debug"></a> [debug](#output\_debug) | Debug output of the API Token |
 <!-- END_TF_DOCS -->

main.tf

@@ -8,24 +8,25 @@ terraform {
   }
 }
 
-data "cloudflare_account_api_token_permission_groups" "this" {
-  account_id = var.account_id
+data "cloudflare_api_token_permission_groups_list" "this" {
 }
 
 locals {
   resources          = length(var.buckets) > 0 ? { for bucket in var.buckets : "com.cloudflare.edge.r2.bucket.${var.account_id}_${var.jurisdiction}_${bucket}" => "*" } : { "com.cloudflare.edge.r2.bucket.*" = "*" }
   token_bucket_names = length(var.buckets) > 0 ? join(",", var.buckets) : "All-Buckets"
+  r2_api_permissions = { for x in data.cloudflare_api_token_permission_groups_list.this.result : x.name => x.id if contains(["Workers R2 Storage Bucket Item Read", "Workers R2 Storage Bucket Item Write"], x.name) }
+  permission_id_list = compact([
+    var.bucket_read ? local.r2_api_permissions["Workers R2 Storage Bucket Item Read"] : null,
+    var.bucket_write ? local.r2_api_permissions["Workers R2 Storage Bucket Item Write"] : null,
+  ])
 }
 
 resource "cloudflare_api_token" "token" {
   name = var.token_name != "" ? var.token_name : "R2-${local.token_bucket_names}-${var.bucket_read ? "Read" : ""}-${var.bucket_write ? "Write" : ""}"
   policies = [{
-    effect    = "allow"
-    resources = local.resources
-    permission_groups = compact([
-      var.bucket_read ? { id = data.cloudflare_account_api_token_permission_groups.this.r2["Workers R2 Storage Bucket Item Read"] }: null,
-      var.bucket_write ? { id = data.cloudflare_account_api_token_permission_groups.this.r2["Workers R2 Storage Bucket Item Write"] }: null,
-    ])
+    effect            = "allow"
+    resources         = local.resources
+    permission_groups = [for x in local.permission_id_list : { id = x }]
   }]
   not_before = var.not_before != "" ? var.not_before : null
   expires_on = var.expires_on != "" ? var.expires_on : null

outputs.tf

@@ -1,21 +1,27 @@
-output "id" {
-  value       = cloudflare_api_token.token.id
-  description = "API Token ID.\nUsed as the Access Key ID"
-}
+# output "id" {
+#   value       = cloudflare_api_token.token.id
+#   description = "API Token ID.\nUsed as the Access Key ID"
+# }
 
-output "value" {
-  value       = cloudflare_api_token.token.value
-  sensitive   = true
-  description = "API Token Value"
-}
+# output "value" {
+#   value       = cloudflare_api_token.token.value
+#   sensitive   = true
+#   description = "API Token Value"
+# }
 
-output "secret" {
-  value       = sha256(cloudflare_api_token.token.value)
-  sensitive   = true
-  description = "Secret Access Key"
-}
+# output "secret" {
+#   value       = sha256(cloudflare_api_token.token.value)
+#   sensitive   = true
+#   description = "Secret Access Key"
+# }
+
+# output "name" {
+#   value       = cloudflare_api_token.token.name
+#   description = "Name of the API Token"
+# }
+
+output "debug" {
+  value       = local.r2_api_permissions
+  description = "Debug output of the API Token"
 
-output "name" {
-  value       = cloudflare_api_token.token.name
-  description = "Name of the API Token"
 }